As technical experts supporting Federal agencies, we are trained to defend against cyber threats. We build walls, we encrypt data, and we train users not to click on suspicious links. But what happens when the threat isn’t a hacker in a hoodie, but the well-meaning infrastructure designed to protect the internet?
Recently, a client system we support faced this exact scenario. We weren’t hacked. We weren’t spoofed. We were bitten by a “watchdog”, a community-driven blocklist that flagged the system as a “Cryptocurrency Wallet Drainer”.
This incident highlights a threat vector known as Reputational Denial of Service (RDoS). It’s dangerous, it’s annoying, and it’s a direct attack on an agency’s mission. PhishDestroy publishes a block list directly used by the Wallet Guard and Honeybadger security tools, and integrated into Pi-hole and AdGuard. As a result, users of these security tools who try to access the agency site will be blocked and told that the site poses a risk. Here’s a play-by-play of what happened, how we responded, and how we ultimately cleared our client’s name:
The Incident: Anatomy of a False Positive
The incident began when the client’s CISO forwarded an alarming “Phishing Abuse Report” from an entity called PhishDestroy.io.
The report was terrifyingly specific. It claimed the client’s system was hosting a “Web3/Crypto Platform” and acting as a “Cryptocurrency Wallet Drainer”. It demanded immediate suspension of the domain, even providing a link to a scan on urlscan.io as evidence.
The Fog of War
Initial reconnaissance was confusing. Our team checked the reputation of the scanning tool (urlscan.io) and found it to be highly trustworthy. This led to a conflation of trust: because the tool was good, they assumed the report was valid. The priority level skyrocketed.
The Investigation
We mobilized our senior technical team with two working theories:
- Email Spoofing: Maybe bad actors were sending fake emails pretending to be the client system.
- Supply Chain Attack: Maybe a malicious JavaScript library had been injected into our code to drain crypto wallets.
To rule out Theory 1, we analyzed our email authentication records and confirmed our SPF and DMARC records were rock-solid. Our DMARC policy was set to p=reject, meaning any spoofed email should be blocked by most receivers. This made the spoofing theory pretty unlikely.
To rule out Theory 2, we ran deep vulnerability scans (including a “Shai-Hulud” scan) on our application and libraries. Result: Clean. No wallet drainers. No malicious JS.
The “Aha!” Moment
With no evidence of compromise, we turned our eyes to the accuser and clicked the “evidence” link PhishDestroy provided from urlscan.io.
The scan didn’t show a crypto drainer. It didn’t show malware. It showed a completely normal, boring government login page. The accuser’s own evidence exonerated us. The report was a baseless false positive, likely triggered by a bot or a malicious user submission that PhishDestroy failed to verify. As a “Shoot First” bot, PhishDestroy is more concerned with quick action than accuracy. This scorched-earth approach can lead to reputable sites, like our clients’, being unfairly flagged
The Resolution
We went on the offensive. After doing some OSINT on PhishDestroy.io and finding it suspicious (they claimed to exist since 2019 but had a domain registered in 2022) we submitted a formal appeal demanding they produce actual evidence.
The result? Anti-climactic. Within 90 minutes, the appeal was auto-approved, and the client system was silently removed from their threat list. No apology, no explanation. Just “Approved.”
The Lesson
While threats continue to evolve, the remedy is the same: deep technical knowledge and a calm, evidence-based response. When the watchdog bites, be ready to prove it wrong.